ETW Viewer

ETW Viewer is a developer-focused tool for Windows ETW traces. It ingests ETW log files or live streams, decodes provider schemas, and applies filters to isolate events of interest. The tool supports offline and live modes, exporting structured results for sharing with teams. It enables performance debugging by exposing event IDs, levels, timestamps, and decoded payloads, empowering engineers to reconstruct execution paths and identify bottlenecks. Conceptually, it treats traces as sequences of events with rich metadata and payloads, and provides the means to filter, group, and correlate those events across processes and threads. The core value lies in reducing time-to-diagnose by presenting a consistent, parseable view of complex traces, while maintaining fidelity to the original data. Use cases include performance profiling, latency analysis, and reliability investigations. Unique value comes from schema-aware decoding, cross-event correlation, and export options that integrate with existing analytics pipelines. Core features include: ETW ingestion, provider-aware decoding, multi-criteria filtering, grouping by process/thread/provider, offline and live processing, payload decoding, and export to JSON/CSV. Typical workflows involve loading a trace, applying time windows and provider filters, inspecting event payloads, and exporting results for further analysis or sharing with collaborators.